inversify

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This leaves release origin less independently verifiable, though the package has strong release and repository activity.

Repo toolingcaution

The project uses Turbo, npm scripts, and TypeScript, but no security-scanning tools were detected. The missing scanning coverage is a modest repository hygiene gap.

Security policycaution

No security policy was found in the linked repository. That weakens vulnerability-reporting transparency for a widely reusable library.

Workflow auditcaution

All 11 workflows were analyzed and action references were fully pinned, with no untrusted checkout or script-injection trigger findings. However, seven workflows grant top-level write access, and high-confidence blanket GitHub App permissions plus template-injection findings require workflow hardening.